BlackFile, a newly identified financially motivated threat group, has reportedly been conducting data theft and extortion attacks against retail and hospitality firms since February 2026. Also tracked as CL-CRI-1116, UNC6671, and Cordial Spider, the group impersonates corporate IT helpdesk staff in voice-based phishing (vishing) calls from spoofed VoIP numbers, directing employees to fake login pages to capture credentials and one-time passcodes. Once credentials are stolen, the attackers register their own devices to bypass MFA, then escalate to executive-level access by scraping internal directories. They use standard Salesforce APIs and SharePoint download functions to search for and exfiltrate sensitive data, especially files containing terms like “confidential” and “SSN.” Stolen data is moved under the guise of legitimate SSO sessions to attacker-controlled servers and later published on the threat actor’s dark web leak site in conjunction with a seven-figure ransom demands sent from compromised or throwaway email accounts. BlackFile has been tentatively linked to “The Com,” an English-speaking cybercriminal network associated with extortion and other serious crimes. “Swatting” of victims’ executives has also been used as a tactic to increase pressure for payments. CTIX analysts’ recommendations fall in line with those recommended by RH-ISAC, encouraging organizations to implement stronger call-handling procedures, MFA-based caller verification, and simulation-based social engineering training to reduce the effectiveness of these attacks.